The Simple Membership plugin for WordPress suffers from an authentication bypass that allows an attacker to impersonate a global WordPress user and gain administrator privileges on a multisite child site. The flaw arises because the plugin associates new membership registrations with existing global users only by matching user names and email addresses. No password or ownership validation is performed, and the plugin fails to detect that the linked user holds an administrator role on the child site. As a result, an unauthenticated user can register a Simple Membership account using the victim’s credentials on a site where public registration is turned on, then change the victim’s global password via the profile edit feature to lock the real account and assume full administrative control.

WordPress sites that use the Simple Membership plugin version 4.8.0 or earlier on a Multisite network. The vulnerability applies to any child site with public user registration enabled. The plugin was partially patched in 4.8.1, mitigating the flaw for upgraded installations.

The vulnerability scores a CVSS of 5.3, indicating a medium severity risk. EPSS is not available, and it is not listed in the CISA KEV catalog. The exploit requires an unauthenticated attacker to register on a child site that allows new account creation and to know the victim’s username and email. Once the victim’s global password is overridden, the attacker inherits administrator rights. While the potential for full site compromise exists, successful exploitation depends on the presence of public registration and a Multisite configuration, limiting the risk to environments that expose both weaknesses.